Tia N.List

Reported by 2 outlets

WordPress Click2Shell pre-auth RCE chain via CSRF in Core

hot0.0
Why this score
Breadth
1.00 / 2.0 · 2 sources
Authority
1.80 / 2.0 · best outlet weight
Severity
0.50 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.60 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
bleepingcomputer.comthreat-intelligence.redeyesecurity.com first seen 22d ago

Timeline

  1. original reporting

    🤖 WordPress 'Click2Shell' (no CVE): pre-auth RCE chain via CSRF in Core. A crafted theme-preview URL installs a theme from the WordPress.org

    www.bleepingcomputer.com · 22d ago · September 21st, 2026

    🤖 WordPress 'Click2Shell' (no CVE): pre-auth RCE chain via CSRF in Core. A crafted theme-preview URL installs a theme from the WordPress.org

    via Mastodon https://www.bleepingcomputer.com/news/security/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server/

  2. update from bleepingcomputer.com

    WordPress Click2Shell flaw lets hackers execute PHP on the server

    bleepingcomputer.com · 22d ago · September 21st, 2026

    Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform’s Core component. The security problem does not have an official identifier but was addressed last week with the release of WordPress version 7.1.1 . It is a pre-authenticated remote code execution chain that allows an attacker to install any theme in the official WordPress.org catalog and run an arbitrary PHP file. Security researcher Paulos Yibelo of the autonomous penetration testing platform pwn.ai discovered Click2Shell and reported it to WordPress on August 22. The researchers explain that "a value from a WordPress theme-preview URL is interpreted once by the WordPress.org Themes API and a second, buggy methods by JavaScript in the Administrator's browser." This enables an attacker to add a WordPress theme to a target website without the administrator explicitly installing it. The researcher found that even if inactive, a theme could still execute PHP during a Customizer preview. It should be noted that even if the attacker does not need to authenticate, a logged-in administrator needs to visit a crafted URL for the Click2Shell exploit to work. An attack could start with a crafted link that leads to installing a vulnerable theme in the catalog. To demonstrate the issue, pwn.ai used a vulnerable

  3. mentioned by www.bleepingcomputer.com

    WordPress Click2Shell flaw lets hackers execute PHP on the server https:// bleepingcomputer.com/news/security/ wordpress-click2shell-flaw-le

    www.bleepingcomputer.com · 22d ago · September 21st, 2026

  4. update from threat-intelligence.redeyesecurity.com

    Click2Shell: one admin click runs PHP on any WordPress before 7.1.1. No elaborate chain required — a single click in wp-admin executes PHP o

    threat-intelligence.redeyesecurity.com · 22d ago · September 21st, 2026

    Click2Shell: one admin click runs PHP on any WordPress before 7.1.1. No elaborate chain required — a single click in wp-admin executes PHP o

    via Mastodon https://threat-intelligence.redeyesecurity.com/blog/click2shell-wordpress-7-1-1-php-rce-2026

Source on GitHub